NSFOCUS Security Team has found a buffer overflow in Software Distributor utilities for HP-UX. By exploiting the vulnerability local attackers could gain root privilege.
The Software Distributor(SD) utilities for HP-UX contain a number of programs such as swinstall. These programs are used to create, install, distribute and manage software products. A buffer overflow exists in the programs that are suid root bit (such as swinstall, swmodify, etc), this allows local attackers to run arbitrary code with root privileges.
If the environment variable LANG is set as an over large string, programs such as swinstall will copy it into a fixed-size buffer without any bounds checking, which causes a stack overflow. By overwriting the returned address and other data in the stack, local attackers can gain root privileges.
Workaround:
NSFOCUS suggests temporarily removing the suid root bit for all the programs in SD utilities: # chmod a-s /usr/sbin/sw*.
Vendor Status:
2002.11.19 Informed the vendor
2002.12.05 Vendor confirmed the vulnerability
2003.11.05 Vendor released a security bulletin (HPSBUX0311-293) and relative patches for the vulnerability.
